PT-2016-1681 · Microsoft · Edge

Lokihardt · Published 2016-04-12 · Updated 2018-10-12 · CVE-2016-0158

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Microsoft Edge (affected versions not specified)

Description The issue is related to errors in security settings, allowing a remote attacker to bypass existing access restriction policies. It is an elevation of privilege vulnerability that occurs when Microsoft Edge does not properly enforce cross-domain policies. This could allow an attacker to access information from one domain and inject it into another domain. However, it does not allow arbitrary code to be run on its own. The vulnerability could be used in conjunction with another vulnerability, such as a remote code execution vulnerability, to take advantage of elevated privileges when running arbitrary code.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-254

Related Identifiers

BDU:2016-01007

CVE-2016-0158

ZDI-16-233

Affected Products

Edge

References · 9

• https://bdu.fstec.ru/vul/2016-01007 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2016-0158 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-038 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0158 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-16-233 · Security Note
• http://securitytracker.com/id/1035522 · Note
• http://technet.microsoft.com/security/bulletin/MS16-038 · Note
• http://zerodayinitiative.com/advisories/ZDI-16-233 · Note
• http://technet.microsoft.com/library/security/ms16-038 · Note